Merge branch '24606-force-password-reset-on-next-login' into 'master'

Force new password after password reset via API

Closes #24606

See merge request !8933

changelogs/unreleased/24606-force-password-reset-on-next-login.yml

+---
+title: Force new password after password reset via API
+merge_request:
+author: George Andrinopoulos

doc/api/users.md

@@ -271,6 +271,7 @@ Parameters:
 - `can_create_group` (optional) - User can create groups - true or false
 - `external` (optional)         - Flags the user as external - true or false(default)
 
+On password update, user will be forced to change it upon next login.
 Note, at the moment this method does only return a `404` error,
 even in cases where a `409` (Conflict) would be more appropriate,
 e.g. when renaming the email address to some existing one.

lib/api/users.rb

@@ -160,6 +160,8 @@ module API
           end
         end
 
+        user_params.merge!(password_expires_at: Time.now) if user_params[:password].present?
+
         if user.update_attributes(user_params.except(:extern_uid, :provider))
           present user, with: Entities::UserPublic
         else

spec/requests/api/users_spec.rb

@@ -305,6 +305,13 @@ describe API::Users, api: true  do
       expect(user.reload.bio).to eq('new test bio')
     end
 
+    it "updates user with new password and forces reset on next login" do
+      put api("/users/#{user.id}", admin), password: '12345678'
+
+      expect(response).to have_http_status(200)
+      expect(user.reload.password_expires_at).to be <= Time.now
+    end
+
     it "updates user with organization" do
       put api("/users/#{user.id}", admin), { organization: 'GitLab' }